9.5. ORACLE RDBMS: .SYM-FILES
.text:60351080 sub_60351080 proc near
.text:60351080
.text:60351080 arg_0 = dword ptr 8
.text:60351080 arg_4 = dword ptr 0Ch
.text:60351080
.text:60351080 push ebp
.text:60351081 mov ebp, esp
.text:60351083 mov eax, dword_60353018
.text:60351088 cmp eax, 0FFFFFFFFh
.text:6035108B jnz short loc_603510CF
.text:6035108D mov ecx, hModule
.text:60351093 xor eax, eax
.text:60351095 cmp ecx, 0FFFFFFFFh
.text:60351098 mov dword_60353018, eax
.text:6035109D jnz short loc_603510B1
.text:6035109F call sub_603510F0
.text:603510A4 mov ecx, eax
.text:603510A6 mov eax, dword_60353018
.text:603510AB mov hModule, ecx
.text:603510B1
.text:603510B1 loc_603510B1: ; CODE XREF: sub_60351080+1D
.text:603510B1 test ecx, ecx
.text:603510B3 jbe short loc_603510CF
.text:603510B5 push offset aAx_unreg ; "ax_unreg"
.text:603510BA push ecx ; hModule
.text:603510BB call ds:GetProcAddress
...
The “ax_unreg” string is also the second string in the strings block!
The starting address of the second function is0x60351080, and the second value in the binary block is
10001080. So this is the address, but for a DLL with the default base address.
We can quickly check and be sure that the first 66 values in the array (i.e., the first half of the array) are
just function addresses in the DLL, including some labels, etc. Well, what’s the other part of array then?
The other 66 values that start with0x0000? These seem to be in range[0...0x3F8]. And they do not
look like bitfields: the series of numbers is increasing.
The last hexadecimal digit seems to be random, so, it’s unlikely the address of something (it would be
divisible by 4 or maybe 8 or 0x10 otherwise).
Let’s ask ourselves: what else Oracle RDBMS’s developers would save here, in this file?
Quick wild guess: it could be the address of the text string (function name).
It can be quickly checked, and yes, each number is just the position of the first character in the strings
block.
This is it! All done.
We will write an utility to convert these .SYM files intoIDAscript, so we can load the .idc script and it sets
the function names:
#include <stdio.h>
#include <stdint.h>
#include <io.h>
#include <assert.h>
#include <malloc.h>
#include <fcntl.h>
#include <string.h>
int main (int argc, char argv[])
{
uint32_t sig, cnt, offset;
uint32_t d1, d2;
int h, i, remain, file_len;
char d3;
uint32_t array_size_in_bytes;
assert (argv[1]); // file name
assert (argv[2]); // additional offset (if needed)